Network Rail (on behalf of The Railway Workers Centenary Memorial Service Committee) (We, Us, Our) are committed to protecting and respecting your privacy.
This Privacy & Cookies Policy (Policy), together with any other documents referred to on https://www.networkrail.co.uk/privacy-notice/ (Our Site) set out the basis on which any personal data We collect from you, or that you provide to Us, will be processed by Us for the purpose of any and all applicable data protection legislation in force from time to time including but not limited to the Data Protection Act 1998 and any replacement legislation, the General Data Protection Regulation (Regulation (EU) 2016/679), the Regulation of Investigatory Powers Act 2000, the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 (SI 2000/2699), the Electronic Communications Data Protection Directive (2002/58/EC), the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2426/2003) and any replacement legislation and all applicable laws and regulations relating to the processing of personal data and privacy, including where applicable the guidance and codes of practice issued by the Information Commissioner or any other supervisory authority, and the equivalent of any of the foregoing in any relevant jurisdiction (DP Legislation).
Please read the following carefully to understand Our views and practices regarding your personal data and how We will treat it. By continuing to use Our Site or any of the functionalities displayed on it you are accepting and consenting to the practices described in this Policy.
We are the controller and are responsible for your personal data. Where any processing is carried out by Glasgows Limited, a company registered in England and Wales with company number 02257022 and whose registered office is at Unit 5 Centurion Court, Farington, Leyland, Lancashire, PR25 3UQ, they do so purely as data processors for the purposes of the Act.
We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this Policy. If you have questions about this Policy, including any requests to exercise your legal rights (including those detailed below), please contact the DPO using the details set out below.
Changes to this Policy and your duty to inform Us of Changes
This version was last updated on 17/05/2018 and historic versions can be accessed by contacting Us. Any changes We may make to this Policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to this Policy.
It is important that the personal data We hold about you is accurate and current. Please keep Us informed if your personal data changes during your relationship with Us.
Information We may collect from you
We may collect and process the following data about you:
A cookie is a small file of letters and numbers that We store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer's hard drive.
We use the following cookies:
You block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of Our Site.
For more information about cookies, please visit: https://www.allaboutcookies.org.
Uses made of the information
We use information held about you in the following ways:
Disclosure of your information
Where and to the extent that you have positively opted-in to permit Us to do so, We may share your personal information with any member of Our group from time to time, which means Our subsidiaries, Our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006.
Where and to the extent that you have positively opted-in to permit Us to do so, We may share your information with selected third parties including:
We may disclose your personal information to third parties:
Where We store your personal data
Whilst not presently the case, the data that We collect from you may be transferred to, and stored at, a destination outside the European Economic Area (EEA). It may also be processed by staff operating outside the EEA who work for Us or for one of Our suppliers. Such staff maybe engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Policy and in the event that this ever becomes necessary shall ensure that this is carried out subject to a Data Transfer Agreement for compliance with the DP Legislation.
All information you provide to Us is stored on Our secure servers. Where We have given you (or where you have chosen) a password which enables you to access certain parts of Our Site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
Unfortunately, the transmission of information via the internet is not completely secure. Although We will do Our best to protect your personal data, We cannot guarantee the security of your data transmitted to Our Site; any transmission is at your own risk. Once We have received your information, We will use strict procedures and security features to try to prevent unauthorised access.
How Long We Keep Your Personal Data
We do not hold any personal data longer than necessary, having considered the purposes for processing.
If you believe that any of the personal information We hold about you is incorrect, you have the right to ask Us to rectify that information at any time.
You may also have the right, in certain circumstances, to request that We delete your personal information, to block any further processing of your personal information or to object to the processing of your personal information. There are some specific circumstances where these rights do not apply and We can refuse to deal with your request.
Where You have opted in You have the right to ask Us not to continue to process your personal data for marketing purposes. You can exercise your right to prevent such continued processing by contacting Us at firstname.lastname@example.org.
If We are processing your personal information based upon your consent (e.g. as part of our marketing or promotional activities), you have the right to withdraw your consent at any time.
If you require any further information about your right to rectification, erasure, restriction of or object to processing or you wish to withdraw your consent please contact Us at email@example.com.
Our Site may, from time to time, contain links to and from the websites of Our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that We do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.
If you think Our collection or use of personal information is unfair, misleading or inappropriate or if you have concerns about the security of your personal information, you also have the right to make a complaint to the Information Commissioner’s Office. You can contact the Information Commissioner’s Office at the following address:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Access to information
You can find out if We hold any personal information about you by making a ‘subject access request’ under the DP Legislation. If We do hold information about you, We will:
You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances.
You can request access to the information we hold about you at any time by contacting us at firstname.lastname@example.org.
Questions, comments and requests regarding this Policy are welcomed and should be addressed to the DPO at email@example.com.